IN RE ADOBE DATA TRACKING Case No. 25-cv-03032-NW LITIGATION ORDER GRANTING MOTION TO DISMISS CONSOLIDATED AMENDED CLASS ACTION COMPLAINT; ORDER GRANTING MOTION TO STAY DISCOVERY Re: ECF Nos. 84, 105
Plaintiffs Nicholas Rapak, Bianca Johnston, Minchul Paul Chwe, Dana Olita, and David Concepcion bring this putative class action against Defendant Adobe Inc., alleging that Adobe unlawfully collects their data and invades their privacy while Plaintiffs browse websites that utilize Adobe’s Experience Cloud Identity Service. Adobe now moves to dismiss the first consolidated amended class action complaint (“FAC”) for failure to state a claim. ECF No. 84. The motion is fully briefed. ECF Nos. 93, 95. For the reasons set forth below, the Court GRANTS the motion with leave to amend. I. BACKGROUND1 Adobe is a software company perhaps best known for its Adobe Acrobat and Photoshop products. Adobe developed the Experience Cloud Identity Service,2 which includes unique,
1 The factual background is drawn from Plaintiffs’ FAC. See ECF No. 78.
2 Plaintiffs do not provide details about Experience Cloud Identity Service. The Court understands it to be a suite of Adobe products, but does not have more information. See FAC ¶ 39 (“Adobe expanded this project by developing the Adobe Experience Cloud Identity Service, which introduced the Adobe Experience Cloud ID or ECID, also known as ‘MID.’ The ECID is a persistent, unique identifier Adobe assigns to each user that enables tracking across Experience persistent identifiers for Adobe users called an Adobe Experience Cloud ID (“ECID”). The ECID is an identifier assigned to each user that enables tracking across Experience Cloud Identity Service products and identity syncing with third-party advertising partners. Id. Plaintiffs allege that Adobe tracks users’ data via their ECID across Experience Cloud Identity Service products and third-party partners’ websites to sell targeted ads. Plaintiffs have been impacted by Adobe’s ECID tracking; “Plaintiffs have visited popular websites and communicated sensitive information with no inkling that Adobe was watching, tracking, and collecting their data across websites and mobile applications and creating highly detailed profiles containing their most sensitive information.” FAC ¶ 8. For example, Plaintiff Rapak visited several websites that incorporate Adobe’s tracking tools. He visited Marriott Bonvoy’s website,3 “which incorporates a host of services encompassed in the Experience Cloud Platform.” Id. ¶ 94. “Without Plaintiff Rapak’s knowledge or consent, Adobe’s tracking technology caused his browser to send detailed information regarding the content of his communications with the Marriott website, revealing personal tastes and preferences.” Id. ¶ 97. Plaintiff Rapak asserts that he would not have used Marriott’s or similarly situated websites (or would have demanded payment for his data), had he known that Adobe was gathering information about him. Plaintiffs contend that Adobe’s tracking and profiling of users is ongoing. Plaintiffs bring nine claims: (1) Violation of Common Law Invasion of Privacy (Intrusion Upon Seclusion); (2) Violation of Article I, Section 1 of the California Constitution (Invasion of Privacy); (3) Violation of the California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code § 631; (4) Violation of CIPA, Cal. Pen. Code § 632; (5) Violation of CIPA, Cal. Pen. Code §§ 638.50, 638.51; (6) Violation of the Comprehensive Computer Data Access and Fraud Act (“CDAFA”), Cal. Pen. Code § 502; (7) Violations of the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §§ 17200 et seq.; (8) Unjust Enrichment; and (9) Injunctive Relief. FAC ¶¶ 185–281. Under Federal Rule of Civil Procedure 12(b)(6), a district court must dismiss a complaint if it fails to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This “facial plausibility” standard requires the plaintiff to allege facts that add up to “more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While courts do not require “heightened fact pleading of specifics,” a plaintiff must allege facts sufficient to “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 570. In deciding whether a plaintiff has stated a claim upon which relief can be granted, the court must assume that the plaintiff’s allegations are true and must draw all reasonable inferences in the plaintiff’s favor. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). But the court is not required to accept as true “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). A. Privacy-Related Claims (First through Sixth Claims) Consent is an element of Plaintiffs’ CIPA claim and a total defense to Plaintiffs’ common law invasion of privacy, California Constitution, and CDAFA claims. See Smith v. Facebook, Inc., 262 F. Supp. 3d 943, 955 (N.D. Cal. 2017), aff’d, 745 F. App’x 8 (9th Cir. 2018) (user consent is a defense under privacy protections under the California Constitution as well as common-law tort claims for intrusion upon seclusion); Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072 (N.D. Cal. 2016) (user consent is a defense under CIPA); Cal. Civ. Code § 3515 (“A person who consents to an act is not wronged by it.”); Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1048 (S.D. Cal. 2023) (“To establish consent under CDAFA, a defendant must ‘explicitly notify users of the practice at issue.’”). Where, as here, consent is an element of at least one claim, “[c]onsideration of consent is appropriate on a motion to dismiss.” Silver v. Stripe Inc., No. 4:20- Holdings, Inc., 78 F. Supp. 3d 1125, 1136 (N.D. Cal. 2015) (“[d]efendants may properly challenge [p]laintiffs’s allegations regarding lack of consent through the instant motion to dismiss”); Smith v. Facebook, Inc., 745 F. App’x 8 (9th Cir. 2018) (affirming motion to dismiss based on plaintiffs’ consent to data tracking and collection practices). Plaintiffs contend the following allegations sufficiently plead lack of consent: • “Without [each named] Plaintiff[’s] knowledge or consent, Adobe’s tracking technology caused [his or her] browser to send detailed information regarding the content of his communications with the . . . website, revealing personal tastes and preferences.” FAC ¶¶ 97, 106, 112, 125. • “Plaintiffs and Class Members did not consent to, authorize, or understand Adobe’s interception or use of their private data.” Id. ¶ 191. ECF No. 93 at 3. Plaintiffs also point to allegations “that Adobe surreptitiously interc
Free access — add to your briefcase to read the full text and ask questions with AI
IN RE ADOBE DATA TRACKING Case No. 25-cv-03032-NW LITIGATION ORDER GRANTING MOTION TO DISMISS CONSOLIDATED AMENDED CLASS ACTION COMPLAINT; ORDER GRANTING MOTION TO STAY DISCOVERY Re: ECF Nos. 84, 105
Plaintiffs Nicholas Rapak, Bianca Johnston, Minchul Paul Chwe, Dana Olita, and David Concepcion bring this putative class action against Defendant Adobe Inc., alleging that Adobe unlawfully collects their data and invades their privacy while Plaintiffs browse websites that utilize Adobe’s Experience Cloud Identity Service. Adobe now moves to dismiss the first consolidated amended class action complaint (“FAC”) for failure to state a claim. ECF No. 84. The motion is fully briefed. ECF Nos. 93, 95. For the reasons set forth below, the Court GRANTS the motion with leave to amend. I. BACKGROUND1 Adobe is a software company perhaps best known for its Adobe Acrobat and Photoshop products. Adobe developed the Experience Cloud Identity Service,2 which includes unique,
1 The factual background is drawn from Plaintiffs’ FAC. See ECF No. 78.
2 Plaintiffs do not provide details about Experience Cloud Identity Service. The Court understands it to be a suite of Adobe products, but does not have more information. See FAC ¶ 39 (“Adobe expanded this project by developing the Adobe Experience Cloud Identity Service, which introduced the Adobe Experience Cloud ID or ECID, also known as ‘MID.’ The ECID is a persistent, unique identifier Adobe assigns to each user that enables tracking across Experience persistent identifiers for Adobe users called an Adobe Experience Cloud ID (“ECID”). The ECID is an identifier assigned to each user that enables tracking across Experience Cloud Identity Service products and identity syncing with third-party advertising partners. Id. Plaintiffs allege that Adobe tracks users’ data via their ECID across Experience Cloud Identity Service products and third-party partners’ websites to sell targeted ads. Plaintiffs have been impacted by Adobe’s ECID tracking; “Plaintiffs have visited popular websites and communicated sensitive information with no inkling that Adobe was watching, tracking, and collecting their data across websites and mobile applications and creating highly detailed profiles containing their most sensitive information.” FAC ¶ 8. For example, Plaintiff Rapak visited several websites that incorporate Adobe’s tracking tools. He visited Marriott Bonvoy’s website,3 “which incorporates a host of services encompassed in the Experience Cloud Platform.” Id. ¶ 94. “Without Plaintiff Rapak’s knowledge or consent, Adobe’s tracking technology caused his browser to send detailed information regarding the content of his communications with the Marriott website, revealing personal tastes and preferences.” Id. ¶ 97. Plaintiff Rapak asserts that he would not have used Marriott’s or similarly situated websites (or would have demanded payment for his data), had he known that Adobe was gathering information about him. Plaintiffs contend that Adobe’s tracking and profiling of users is ongoing. Plaintiffs bring nine claims: (1) Violation of Common Law Invasion of Privacy (Intrusion Upon Seclusion); (2) Violation of Article I, Section 1 of the California Constitution (Invasion of Privacy); (3) Violation of the California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code § 631; (4) Violation of CIPA, Cal. Pen. Code § 632; (5) Violation of CIPA, Cal. Pen. Code §§ 638.50, 638.51; (6) Violation of the Comprehensive Computer Data Access and Fraud Act (“CDAFA”), Cal. Pen. Code § 502; (7) Violations of the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §§ 17200 et seq.; (8) Unjust Enrichment; and (9) Injunctive Relief. FAC ¶¶ 185–281. Under Federal Rule of Civil Procedure 12(b)(6), a district court must dismiss a complaint if it fails to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This “facial plausibility” standard requires the plaintiff to allege facts that add up to “more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While courts do not require “heightened fact pleading of specifics,” a plaintiff must allege facts sufficient to “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 570. In deciding whether a plaintiff has stated a claim upon which relief can be granted, the court must assume that the plaintiff’s allegations are true and must draw all reasonable inferences in the plaintiff’s favor. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). But the court is not required to accept as true “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). A. Privacy-Related Claims (First through Sixth Claims) Consent is an element of Plaintiffs’ CIPA claim and a total defense to Plaintiffs’ common law invasion of privacy, California Constitution, and CDAFA claims. See Smith v. Facebook, Inc., 262 F. Supp. 3d 943, 955 (N.D. Cal. 2017), aff’d, 745 F. App’x 8 (9th Cir. 2018) (user consent is a defense under privacy protections under the California Constitution as well as common-law tort claims for intrusion upon seclusion); Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072 (N.D. Cal. 2016) (user consent is a defense under CIPA); Cal. Civ. Code § 3515 (“A person who consents to an act is not wronged by it.”); Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1048 (S.D. Cal. 2023) (“To establish consent under CDAFA, a defendant must ‘explicitly notify users of the practice at issue.’”). Where, as here, consent is an element of at least one claim, “[c]onsideration of consent is appropriate on a motion to dismiss.” Silver v. Stripe Inc., No. 4:20- Holdings, Inc., 78 F. Supp. 3d 1125, 1136 (N.D. Cal. 2015) (“[d]efendants may properly challenge [p]laintiffs’s allegations regarding lack of consent through the instant motion to dismiss”); Smith v. Facebook, Inc., 745 F. App’x 8 (9th Cir. 2018) (affirming motion to dismiss based on plaintiffs’ consent to data tracking and collection practices). Plaintiffs contend the following allegations sufficiently plead lack of consent: • “Without [each named] Plaintiff[’s] knowledge or consent, Adobe’s tracking technology caused [his or her] browser to send detailed information regarding the content of his communications with the . . . website, revealing personal tastes and preferences.” FAC ¶¶ 97, 106, 112, 125. • “Plaintiffs and Class Members did not consent to, authorize, or understand Adobe’s interception or use of their private data.” Id. ¶ 191. ECF No. 93 at 3. Plaintiffs also point to allegations “that Adobe surreptitiously intercepts data from [websites and apps] while hiding in the background” and “does not provide any information about which websites or apps include its technology, what data it intercepts, or how it is used.” Id. (citing FAC ¶¶ 54, 136–41, 193). But as many courts have found, “[g]enerally, the internet is not a place where users have a reasonable expectation of privacy.” Thomas v. Papa Johns Int’l, Inc., No. 22-cv-2012 DMS (MSB), 2024 WL 2060140, at *1 (S.D. Cal. May 8, 2024), aff’d, No. 24-3557, 2025 WL 1704437 (9th Cir. June 18, 2025). To that end, Plaintiffs must do more than merely assert that they did not consent to the tracking devices. Iqbal, 556 U.S. at 678; Washington v. Flixbus, Inc., No. 25-CV- 00212-H-MSB, 2025 WL 1592961, at *3 (S.D. Cal. June 5, 2025) (refusing to accept as true the “legal conclusion” that plaintiff “did not consent to the data practices at issue in the complaint.”). Accordingly, the Court GRANTS the motion to dismiss Plaintiffs’ CIPA, common law invasion of privacy, California Constitution, and CDAFA claims with leave to amend. B. UCL Claim (Seventh Claim) Plaintiffs bring a claim for unlawful and unfair business practices under the UCL, and seek restitution, declaratory relief, and “other appropriate equitable relief.” See FAC ¶¶ 258-271. “The Ninth Circuit has held that plaintiffs seeking equitable relief under the UCL in a federal court Meta Pixel Tax Filing Cases, 724 F. Supp. 3d 987, 1023 (N.D. Cal. 2024) (citing Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020)). To meet this burden, Plaintiffs must plead “specific facts showing that damages are ‘inadequate or incomplete.’” Norman v. Gerber Prods. Co., No. 21-CV-09940-JSW, 2023 WL 122910, at *3 (N.D. Cal. Jan. 6, 2023) (internal citation omitted). Here, Plaintiffs fail to allege that they lack an adequate remedy at law. See FAC ¶¶ 258-271. Nor have Plaintiffs alleged their claims in the alternative, in the event there was no adequate remedy at law. Plaintiffs do not assert that the monetary damages (including punitive damages) available from their CIPA, common law invasion of privacy, California Constitution, and CDAFA claims—assuming Plaintiffs adequately amend—will be “inadequate or incomplete” to address Plaintiffs’ monetary or property losses, the alleged on-going behavior by Adobe, or the benefit provided to Adobe from using Plaintiffs’ data. At this pleading stage, while Plaintiffs “need not explain in great detail why [their] legal remedies are insufficient[,]” they must at least provide “an allegation to that effect.” Rabin v. Google LLC, 725 F. Supp. 3d 1028 (N.D. Cal. 2024); compare In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d at 1023 (finding UCL claim adequately pled where plaintiffs “explicitly allege[d] that they ‘lack an adequate remedy at law’” and “discuss[ed] in detail the distinctions between damages and restitution, asserting that restitution may result in a greater award than damages.”). Defendant’s motion to dismiss is GRANTED with leave to amend. C. Unjust Enrichment and Injunctive Relief (Eighth and Ninth Claims) Plaintiffs cannot maintain their unjust enrichment claim because, in California, “[u]njust enrichment is not a cause of action.” De Havilland v. FX Networks, LLC, 21 Cal. App. 5th 845, 870 (2018) (quoting Hill v. Roll Int’l Corp., 195 Cal. App. 4th 1295, 1307 (2011)). State and federal “courts have consistently dismissed stand-alone claims for unjust enrichment.” Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 132 (N.D. Cal. 2020). The same is true for Plaintiffs’ claim for injunctive relief. Mishiyev v. Alphabet, Inc., 444 F. Supp. 3d 1154, 1161 (N.D. Cal. 2020), aff’d, 857 F. App’x 907 (9th Cir. 2021) (“California does not recognize a standalone claim for injunctive relief.”). The Court therefore GRANTS Adobe’s motion to dismiss Plaintiffs’ unjust enrichment ] enrichment claim as a quasi-contract claim, Plaintiffs are granted leave to amend on that narrow 2 ground. See Jn re Facebook, Inc., Consumer Priv. User Profile Litigation, 402 F. Supp. 3d 767, 3 803 (N.D. Cal. 2019) (courts in this district have let claims titled unjust enrichment go forward 4 when they are in fact quasi-contract claims seeking restitution). 5 IV. CONCLUSION 6 Adobe’s motion is GRANTED with leave to amend. Lopez v. Smith, 203 F.3d 1122, 1127 7 (9th Cir. 2000) (pursuant to Rule 15(a), leave to amend “should be freely granted when justice so 8 requires,” keeping in mind the underlying purpose of Rule 15 is “to facilitate decision on the 9 merits, rather than on the pleadings or technicalities.”) (en banc) (internal quotes and ellipses 10 omitted). Plaintiffs shall file an amended complaint within 21 days from this Order. 11 Adobe additionally moved to stay discovery until resolution of its motion to dismiss. ECF 12 No. 105. A district court “may, for good cause, issue an order to protect a party or person from . . 13 . undue burden or expense,” including by staying discovery. Fed. R. Civ. P. 26(c)(1). With this 14 Order, the Court dismisses Plaintiffs’ complaint in full, though grants leave to amend. Because 15 || the scope of Plaintiffs’ anticipated amended complaint is not clear, the Court finds good cause to a 16 STAY discovery until Defendants answer the forthcoming second amended complaint. Zz 18 || Dated: September 2, 2026 19 WeQ bid Noél Wise 20 United States District Judge 21 22 23 24 25 26 27 28